Child Safeguarding Standards: a Legal Duty

Ania runs a one-person physiotherapy practice. Most of her patients are adults recovering from orthopaedic injuries, but once a week she also treats eight-year-old Kuba for a postural issue, referred by his mother through word of mouth. When someone in a local physiotherapists' group posted that, since August 2024, practices treating children must have written Child Safeguarding Standards in place, Ania assumed it surely only applied to schools and kindergartens. After all, she sees one minor a week -- she doesn't run a nursery.

This is a common mistake. Among the facilities covered by the duty, the Act lists medical ones too, and it sets no threshold for the number of minor patients or any paediatric specialisation. In this article we explain where the duty comes from, what the standards must define, what the penalties are, and how to approach implementation at a small practice without a team of lawyers.

Where the SOM duty comes from -- "Kamilek's Law"

The legal basis is the Act of 13 May 2016 on Counteracting Threats of Sexual Crime and Protecting Minors (consolidated text: Journal of Laws 2026 item 110). The provisions on standards, that is Chapter 4b of the Act (Articles 22b and 22c), were added by the Act of 28 July 2023 amending the Family and Guardianship Code and certain other acts (Journal of Laws 2023 item 1606), commonly known in the industry as "Kamilek's Law" (ustawa Kamilka). It entered into force on 15 February 2024. Entities had 6 months from that date to introduce the standards (Article 10 of the amending Act), which by our calculation means 15 August 2024.

Article 22b imposes the duty to introduce standards on the managing body of a facility (including a medical one) that minors attend, stay in or may stay in, and on the organiser of activity (including medical activity) for minors. The legislator therefore did not limit the duty to educational institutions.

Who exactly is covered

We found no threshold in the Act for the number of minor patients or for revenue below which the duty would not apply. From the wording of Article 22b, the duty most likely covers, among others:

• one-person physiotherapy practices treating even a single minor patient,
• group practices and physiotherapy clinics, whether or not they have a dedicated paediatric department,
• practices that treat children only occasionally.

The edges of the scope (for example home visits, or a practice that does not treat children but formally could) are for you to determine under Article 22b, and we do not settle them for you. If in doubt, ask a lawyer.

Some physiotherapists confuse SOM with documents they already have. For more on not getting lost in compliance requirements, see our article on the most common compliance mistakes at physiotherapy practices.

What the standards must define

Child Safeguarding Standards aren't a single page with a general statement like "we care about children's safety." Article 22c(1) lists eight elements that the standards define "in a way adapted to the nature and type of the facility or activity".

Element of the standards	What it covers	Basis
Safe staff-minor relationships	Rules for relationships and prohibited behaviour, including physical contact during therapy	Art. 22c(1)(1)
Intervention	Rules and procedure for acting on suspected harm or information about harm	point 2
Notifications	Procedures and persons responsible for reporting a suspected offence and notifying the guardianship court	point 3
Review and update	Rules for reviewing and updating the standards	point 4
Preparing staff	Competence of the responsible person, rules for preparing staff and how it is documented	point 5
Making them available	Rules and manner of making the standards available to parents or guardians and to children	point 6
Receiving reports	Persons responsible for receiving reports and supporting the minor	point 7
Documenting incidents	How disclosed or reported events are documented and stored	point 8

For standards introduced at a facility, four further elements from paragraph 2 are added: requirements for safe relationships among minors themselves, rules for using electronic devices with internet access, procedures protecting children from harmful content and online threats, and rules for setting a support plan for a minor after harm is disclosed. The standards must also take into account children with disabilities (paragraph 4) and be written so that minors can understand them (paragraph 5).

Relationships and physical contact during therapy

This section describes what behaviour is and isn't acceptable towards a minor patient. In physiotherapy it matters a great deal, because working with a child's body is part of the treatment. Describe, among other things, the rules for physical contact during therapy, a parent's presence in the treatment room, and communication outside visits.

Responding to suspected harm and reporting

The Act requires an intervention procedure (point 2) and procedures for reporting a suspected offence and notifying the guardianship court (point 3). In practice it is convenient to separate them into two paths. An internal procedure: what staff do when they notice worrying signs such as bruising, changes in behaviour or concerning relationships around the child. An external procedure: who, when and to whom makes the report (family and guardianship court, police, prosecutor's office). This split is our organising suggestion; the Act does not impose it.

In practice, the lack of a written path means delay and confusion in a situation that demands a fast response.

Internet and devices

If the practice has wi-fi, a tablet in the waiting room or a computer a child could use, the standards must set rules for using such devices and procedures protecting children from harmful content (Article 22c(2)(2) and (3)).

Preparing staff and documenting incidents

The standards describe who prepares staff to apply them and how this is documented (point 5). For details and an example wording, see the article on staff training in the child safeguarding standards. Separately, you define how disclosed or reported incidents are documented and stored (point 8), in line with confidentiality principles and restricted access to such information.

Assessing the standards at least every two years

Introducing the standards is not the end of the duties. Article 22c(6) obliges the covered entities to assess the standards at least once every two years, to keep them adjusted to current needs and compliant with the applicable law. The conclusions of the assessment must be documented in writing. How to count the two years, what to check in the review and how to record the conclusions is covered separately in the article on evaluating child safeguarding standards.

The shortened version and making the standards available

The Act requires the standards to be available in two versions: the full one and a shortened one intended for minors. The shortened version contains information relevant to minors. You make both versions available on your website (if you have one) and display them in a visible place on the premises, usually the waiting room or the entrance (Article 22c(7)). It is a short, simple text telling the child that they have the right to feel safe and who they can turn to if something worries them. The full version written in legal language does not satisfy this requirement on its own. For more on the children's version, see our article on child safeguarding standards for children.

Checking people before they are allowed to work

This is a separate duty under Article 21 of the Act, not an element of the standards under Article 22c. Before establishing an employment relationship or allowing a person into other activity related to the treatment of minors, the employer or other organiser:

• obtains information on whether the person's data is in the Restricted-Access Register (and in the register of persons entered by a decision of the State Commission),
• receives from the person an extract from the National Criminal Register, and from foreign nationals additional documents or statements,
• records the register information as a printout and attaches it to the personnel file or to the documentation of the person allowed into the activity (Article 21(2), (3) and (9)).

The provision also covers contractors, trainees and interns, because it speaks of allowing a person into "other activity". You do the check before the person starts working with children, not a few months in. Merely browsing the public database is not enough. We describe the procedure step by step in the article on checking an employee in the offender register. We did not check the guidelines of the Team for the Protection of Minors, so we do not know whether they recommend describing this check in the standards document itself.

[SP] Example -- Solo practice: After reading about SOM, Ania writes a one-page procedure for responding to suspected harm, describes the rules for physical contact and a parent's presence during therapy, puts the child-friendly summary up in the waiting room and records the implementation date. She also notes the date of the first assessment of the standards and knows that when she hires anyone she will check that person in the register first.

[GR] Example -- Group practice: At a clinic with eight therapists and a dedicated paediatric department, SOM requires more organisational work: every person allowed to work with children has to be checked, the document must name the people who receive reports, all staff must be prepared to apply the standards, and that fact must be recorded. That way everyone knows who to report a worrying sign to.

How to implement SOM at a small practice

For a one-person practice, implementation does not have to mean a heavy structure. A practical order of steps:

1. Write the rules for safe contact with a child during therapy, including whether a parent is present in the room and the physical-contact norms typical of physiotherapy treatment.
2. Describe the intervention and reporting procedure: who you call, what you note down and who files the report.
3. Name the people who receive reports and support the child. At a one-person practice that is usually the owner.
4. Set the rules for internet and device use by minors on the premises, even if you only have one tablet in the waiting room.
5. Decide how you will document and store any reports, and how you will prepare staff to apply the standards.
6. Describe the rules for review and update and plan the first assessment of the standards.
7. Prepare and display the shortened version for children, and put the full and shortened versions on your website if you have one.
8. Sign and date the whole document. The implementation date is the first thing an inspector will ask about, and it is the most cautious starting point for counting the two-year assessment.

If you treat children regularly, it is worth pairing this process with a review of parental consent forms for therapy, because both documents concern the same group of patients. For more on collecting consent correctly, see our article on paediatric physiotherapy and parental consent.

Penalties for not having SOM

Sanctions differ depending on which duty was breached. For failing to introduce the standards, Article 23b(1) provides a fine of up to PLN 250 or a reprimand, and upon a repeated finding of failure to comply, a fine of not less than PLN 1,000 (paragraph 2). After a penalty for repeated failure to introduce the standards, the court additionally orders a monetary payment to the Fund for Assisting Victims, not exceeding PLN 10,000 (Article 24a(2)). The penalty applies to whoever is obliged to introduce the standards and does not do so, and at a one-person practice that is the owner.

The Act treats breaches concerning checking people more severely. Allowing a person to work with minors without obtaining the register information is punishable by detention, restriction of liberty or a fine of not less than PLN 1,000 (Article 23(2)). The same penalty applies to allowing a person you know is in the Register or has been finally convicted of the listed offences (Article 23a). The penalty is higher still for allowing a person subject to a court ban on working with minors: imprisonment from 3 months to 5 years (Article 23c).

In other words: the mere absence of the SOM document carries a relatively low penalty, but the most serious consequences relate to whom you allow to work with children.

Who checks SOM compliance

The Act names specific bodies. Compliance with the duties under Articles 21 and 22b is inspected by the wójt, mayor, starost and the voivodeship marshal (Article 22x), and, within its remit, by the President of the NFZ (Article 22z). The duty to check a person in the register (Article 21(2)) is also inspected by the National Labour Inspectorate (Article 22y). An inspector may enter the premises between 8 am and 6 pm, request information and demand documents (Article 22x(4)), and after finding a breach or a justified suspicion of one, notifies the police or the prosecutor (paragraph 6). A report with post-inspection recommendations is drawn up from the inspection.

We did not find the National Chamber of Physiotherapists (KIF) among the bodies inspecting SOM in the Act. We discuss other inspections of a practice, for example a KIF inspection, separately. We did not check how inspections of the standards work in practice at physiotherapy practices.

SOM is not GDPR and not your organisational regulations

One of the most common mistakes is assuming that, having already implemented GDPR and written the organisational regulations of the practice, the child-protection topic is "somehow covered". SOM is a separate document, required under a different act, with a different purpose and scope.

• GDPR governs the processing of patients' personal data, including children's, but does not describe procedures for responding to harm or for checking people allowed to work with minors.
• Organisational regulations describe the general rules for how the practice operates -- opening hours, scope of services, booking rules. They don't replace child-safeguarding procedures.
• SOM focuses on children's safety: relationships, responding to harm, preparing staff and documenting incidents.

Having one of these documents does not exempt you from having the others.

Frequently asked questions

Does a one-person physiotherapy practice need SOM if it only treats one child a week?

Most likely yes. Article 22b covers medical facilities that minors attend, stay in or may stay in, and sets no threshold for the number of patients or the size of the business. You decide whether your practice is covered on the basis of that provision, with a lawyer if in doubt. By our calculation the deadline for introducing the standards passed on 15 August 2024.

How is SOM different from a parent's consent to a child's therapy?

They're two separate documents with different purposes. Parental consent relates to a specific patient and specific therapy. SOM is a systemic document covering the whole practice, describing safety rules, preparation of staff and harm-response procedures for all minor patients, regardless of any individual consent.

Does a trainee or intern also need to be checked in the register?

Yes. Article 21(1) applies both to establishing an employment relationship and to allowing a person into other activity related to the treatment of minors, so it covers contractors, trainees and interns as well. You do the check before the person starts working with children.

What are the penalties for not having SOM implemented at a practice?

For failing to introduce the standards, Article 23b provides a fine of up to PLN 250 or a reprimand, and upon a repeated finding of failure to comply, a fine of not less than PLN 1,000. More serious sanctions (detention, restriction of liberty or a fine of not less than PLN 1,000) apply to allowing a person to work with children without the required check (Article 23(2)).

---

Legal status as of: 3 November 2026

Legal basis: Act of 13 May 2016 on Counteracting Threats of Sexual Crime and Protecting Minors (consolidated text Journal of Laws 2026 item 110), Articles 21(1)-(3) and (9), 22b, 22c(1), (2) and (4)-(7), 22x, 22y, 22z, 23, 23a, 23b, 23c and 24a(2); Act of 28 July 2023 amending the Family and Guardianship Code and certain other acts (Journal of Laws 2023 item 1606), Articles 10 and 12. We checked the acts amending it after 21 January 2026 that we found: Journal of Laws 2026 item 187 (amends Article 22j(6)) and item 421 (amends Articles 7 and 12). They do not change Articles 21-24a. We did not check: the guidelines of the Team for the Protection of Minors, the inspection practice of the authorities, the rules on bans from holding positions, or whether home visits or a practice treating only adults are covered by Article 22b. The range of entities in Article 22b (whether your practice is covered by the duty) requires your own assessment, preferably with a lawyer.

Last reviewed: 3 November 2026

Compliance at a physiotherapy practice isn't just medical records and GDPR -- it also includes duties like SOM that are easy to overlook while running a practice day to day. See how FizjoReady packages support getting your practice's paperwork in order. See FizjoReady packages →

Related articles:
- KIF inspection at your practice -- what to expect and how to prepare
- Paediatric physiotherapy -- parental consent
- Most common compliance mistakes at physiotherapy practices
- Evaluating Child Safeguarding Standards
- Training on Child Safeguarding Standards